Security bound of continuous- variable quantum key distribution 
with noisy coherent states and channel 
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Security of a continuous-variable quantum key distribution protocol based on noisy coherent states and chan- 
nel is analyzed. Assuming the noise of coherent states is induced by Fred, a neutral party relative to others, 
we prove that the prepare and measurement scheme and entanglement-based scheme are equivalent. Then, we 
show that this protocol is secure against Gaussian collective attacks even if the channel is lossy and noisy, and 
further, a lower bound to the secure key rate is derived. 
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The principles of quantum mechanics make it possible to 
distribute physically secure keys between two distant parties 
fl, 2]. In particular, continuous-variable quantum key distri- 
bution (CV-QKD) has made remarkable achievements during 
the past few years. Several CV-QKD schemes based on co- 
herent states combined with homodyne or heterodyne detec- 
tion have been proposed 13|, |4j[] and experimentally demon- 
strated lUtl-lH], and the unconditional security of CV-QKD 
with ideal optical source has also been systematically stud- 
ied fl E [iE [Hi. However, there still have difficulties to 
calculate the secure key rate of the CV-QKD protocols with 
noisy coherent states, because of the absence of a good model 
to characterize the source imperfections. For instance, it is not 
a good idea to ascribe the source imperfection to the channel 
excess noise directly, which implies that Eve is able to control 
such noise. In this case. Eve actually knows that Alice is using 
a P&M scheme instead of an E-B one, and the two schemes 
are no longer equivalent. Further more, from a practical view- 
point, it is suspicious to assume that Eve is able to control 
the noise inside Alice's side. The same topic was discussed 
recently in which the noise of source and modulation 
is controlled neither by legitimate users nor eavesdroppers. 
However, under this assumption. Eve can not purify the states 
of Alice and Bob, which implies that the previous proof on 
the optimality of Gaussian attacks [14] is not available. As 
a result, the key rate derived in il3ll may be insecure under 
collective attack. 

To solve these problems, in this paper, we propose a new 
way to characterize the source and modulation noise and de- 
rive a security bound of the CV-QKD protocol through a lossy 
and noisy channel. As we know, in a standard prepare and 
measurement (P&M) scheme, Alice generates two Gaussian 
random numbers, Qa and Pa, with mean values and vari- 
ances Va, to prepare \Qa + iPa) by modulating an initial co- 
herent state. Then, she sends this state to Bob through a 
quantum channel characterized by transmittance T and ex- 
cess noise ec- Receiving the state. Bob randomly chooses one 
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FIG. 1: (color online) The P&M scheme. A random number gen- 
erator (RNG) gives two values Q/^ and P/^. The coherent state is 
generated in source (Src) with shot noise {6Qa,6Pa), and then, its 
central position in phase space is displaced by Gaussian modulations 
with {Qa + A(2a, Pa + APa)- The noise /S.Qa and AFa is assumed to 
be individually induced by a neutral party, Fred. 



quadrature to measure and informs Alice which observable he 
measured. Then, Alice and Bob should share two correlated 
Gaussian variables, from which they can extract a private bi- 
nary key with standard reconciliation and privacy amplifica- 
tion process. However, in a realistic case, the optical source 
and modulators are imperfect and inevitably induces extra ex- 
cess noise (denoted by two Gaussian random numbers AQa 
and APa) to the coherent state. As a result, Alice actually pre- 
pares a state of \{Qa + AQa) + i{PA + ^Pa)), where AQa and 
Af A, independent with Qa and Pa, have mean values and 
variances eo 1 13]. In a trusted-source model, neither Eve nor 
Alice can control this excess noise. So, it is convenient to phe- 
nomenologically assume that the noise of coherent state is not 
induced by the imperfection of devices but by a neutral party, 
Fred, who generates two random numbers, AQa and APa, and 
then introduces corresponding extra noise to the coherent state 
after an ideal modulation (See Fig. 1). In this case, the state 
sent to Bob is denoted by quadratures {Q,P), which satisfy 

Q^Qa+6Qa + I^Qa, 

P^Pa+6Pa + APa, ^ ' 

where SQa and 6Pa are originated from shot noise, and satisfy 
{^Qa) ~ {^^a) ~ ^' shot-noise units. The conditional 
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FIG. 2: (color online) The E-B scheme. Fred prepares p/^g for Alice. 
In order to prepare a coherent state for Bob, Alice can measure both 
quadrature of her beam with a balanced heterodyne detector 
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For the convenience of theoretical analysis, here we pro- 
pose an entanglement based (E-B) scheme and will show it is 
equivalent to the P&M scheme. As shown in Fig. |2l Fred pre- 
pares a pair of EPR beams pab, and holds its purification. The 
global pure state shared by Alice, Bob and Fred is denoted by 
VI^abf), and pab is assumed to be a Gaussian state. Quadra- 
tures iQ,P) denote the state sent to Bob, and {Q',P') denote 
the state kept by Alice. Here, we assume {Q,P) and (Q',P') 
satisfy 

(e') = (^') = (V + eo), = ^ y, (3) 

where V - Va + I- According to ifTsll . we obtain 

/q,2\ 

I (QQ') \' < {Q') {Q") - - + -o)^ -^-^^^ 
We assume that 



(QQ') = Vy2-i, (5) 

which absolutely satisfies Eq. (|4]i. Similarly, we assume that 

{pp') = - Vy2- 1. (6) 

In E-B scheme, Alice makes a balanced heterodyne detection 
on Q' and P' simultaneously. Denoting the values of Q' and 
P' measurements as and P'^, we have jjisj] 



Q'^Q'a+SQa, P'^P'a+5P'a. 



(7) 



where (^e^^) = [dP'^^) = 1. Alice's best estimate of (g, P) 
is denoted by {Qa, Pa), which satisfy ifTsIl 
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We can easily get 

{Ql)-{p\)-(y-^)-yA, 



P' 



(8) 



(9) 



which shows the same result as in P&M scheme. Let us sup- 
pose the EPR source and the measuring apparatus of Alice are 
hidden in a black box. The only outputs of this black box are 
the values of sq, Qa and Pa, and the beam {Q, P). For Eve, this 
black box is indistinguishable from the equivalent black box, 
sketched in the P&M scheme. So, we can calculate the se- 
cure key rate in the E-B scheme. When Eve makes collective 
attacks, she interacts individually with each quantum state in 
the same way. Accordingly, the global state \4iabf) becomes 
Wabef)- After Alice and Bob's measurements, Alice, Bob and 
Eve should share correlated Classical-Classical-Quantum in- 
formation (CCQ correlations) |16], and the security key rate 
can be calculated by 1 17] 



Ko ^ I{a : b) - xia : E), 
KR^I(a:b)-x(b:E\ 



(10) 



where Kq and Kr correspond to the direct and reverse rec- 
onciliation, respectively. I{a : b) is the Shannon mutual in- 
formation between Alice and Bob. xi'^ ■ E) - S(pe) - 
j P(a)S(pl)da and x(b : E) = Sips) - J P{b)S(p),)Ab are 
Holevo bounds 1 18.1 , which put an upper limit on how much 
information can be contained in a quantum system. S(pe) is 
the von Neumann entropy of Eve's state pE, and S ip"^) [S (p|)] 
is the von Neumann conditional entropy of pE while knowing 
the measurement value a (b) of Alice (Bob). However, since 
pABE is not a pure state, and the optimality of Gaussian attacks 
has not been proved, we can not calculate a minimum Kq or 
Kr directly. Fortunately, if we suppose the state of Fred can be 
controlled by Eve, and \iPabef) is a pure state, we can derive a 
lower bound of Kd or Kr, denoted by Kq and Kr, where 



Kd = I{a : b)-x(a : EF), 
KR^I(b:a)-x(b:EF), 



(11) 



where xi^i '■ EF) and x(b ■ EF) are the Holevo bounds be- 
tween Alice and the eavesdroppers. It can be proved that IJ9ll 



Xia : EF) - xia : E) > 0. 



(12) 



Since Pabef is a pure state, it has been proved that Kd and 
Kr get their minimal values when pab is a Gaussian state 
iflill . The Shannon mutual information is given by I{a : b) = 
1/2 log2(yi!,/yfe|fl), where Vh is the variance of the random vari- 
able of Bob, and Vb\a is the conditional variance of the random 
variable of Bob while knowing Alice's measurement. Here, 
we can only calculate the case of Q quadrature for the sym- 
metry in Q and P. Let Qb' be the result of Bob's measurement 
on the Q quadrature and Qa be Alice's best estimate of Qb'- 
We obtain 



Vh^{Ql)^T(V+x), 

v,,.^{Ql)-^Q^^ni+x), 



(13) 



where = (1 - T)IT H- so + Ec, and Sc denotes the excess noise 
in the channel. Hence 



I{a :b)^ - log2 — — 
2 \ 1 +^ 



(14) 
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Since pabef is pure, we Yiwe. S {pef)-S (pab)- So, 
Xia : EF) = S{pef) - / P(fl)5(p°^)dfl 
^SipAB)- /P(fl)5(p°^)dfl. 



(15) 



For a two-mode Gaussian state pab, we can calculate its von 
Neumann entropy with its co variance matrix jab 1.20.1 . which 
can be expressed as 



Jab = 



A C 
B 



(16) 



where A, B and C are 2 x 2 blocks. Let A(yAB) - detA + 
detB + 2detC, and 



^{yAB) + VA2(rAB)-4det(y^B) 
^1,2=^ ^ • (17) 

Then the von Neumann entropy of pab is 12] 

S(pAB)^g{si)+g{S2), (18) 

where 

X+l I X+\\ X - I ( X - l\ 

^(x)=-— log2 -— --— log2 -— . (19) 
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In the case where Alice prepares coherent states and Bob 
makes homodyne detection, it is easy to see that the covari- 
ance matrix of pab is 



7ab 



xl zcr 
zcr yl 



(20) 



where x ^ V, y ^ T(V + x), z = V^XV^^^, I = diag(l, 1) 
and cr - diag(l, -1). So 



det(r^B) = (r + Txvf, 

A(7ab) = V' - 2r(y2 -l) + (TV+ Txf 



(21) 



When Alice makes her measurement, she splits her mode into 
two beams by a 50:50 beam splitter, and measures the Q and 
P quadratures of two beams respectively. If Bob chooses a 
quadrature to measure, say, the Q quadrature, then Alice dis- 
cards the result of the measurement on the P quadrature. It 
is easy to see that the two mode state p^^ is still a Gaussian 
state. The covariance matrix of this state is 



T{V^ - 1) 



2T{V- 1) 
V+l 



r(i +x) 





T{V^ - 1) 
2 



T{V+x) 



(22) 



and 



det(r«5) = (r + Tx){T + TxV), 

A(y«^) = 2r + T^xil +x) + [T^X + a- Tf] V. 



(23) 



It can be found that the von Neumann conditional entropy 
Sip'^g) does not depend on Alice's measurement a. So the 
Holevo bound is simply equal to 



X(a:EF)^S(pAB)-S(p';,sy 



(24) 



At the high modulation Umit (V » 1/(1 - T), 1 /T), the lower 



bound of the secure key rate for the direct reconciliation is 



Tx 



T^X + i^-T)- 



- logzd - T) 



'{i-t) 



+ 8 



V(l +X)XT 



(25) 



^JT^X + (1-T)\ 
Similarly, we can derive ^^°™ in the high modulation limit, 

- \ log2 ( Y7^) - log2(l - ^) - ^ ( ■ (26) 
The limiting value of eo is shown as 



«=2 



e- 



0.39. 



(27) 
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FIG. 3: (color online) The lower bound and the secure key rate as 
a function of the transmittance of the channel; solid line-A'jj"™, dash 
line-A:h°m 



We will give a demonstration on how much the security bound 
is lower than the key rate derived in [13]. For comparing with 
the result in ifisll . we just consider the effect of the noisy co- 
herent states, and any excess noise in the channel is now as- 
sumed to be negligible. When the channel is noiseless, the 
key rate derived in lITsIl is 



+ l-T]T(l+x) 



,V + EQ 

and in the high modulation limit it becomes 



K 



horn 



1 



T{l-T)il+x) 



(28) 



(29) 



There is no limiting value of eq in this case. If sq - 0, K^°'" 
and X^"" are the same, otherwise K^""^ is obviously smaller 
than as shown in Fig. [3] The exact secure key rate is just 
between the solid line and the dash line. So we can estimate 
how much information is lost when we use the lower bound. 
However, if the noise of the source is too large, the security 
bound will be too low and the gap between the solid line and 
dash line will be too large. In this case, it is hard to estimate 
how much information we lose. This problem can be solved 
if we can effectively purify the coherent state and reduce the 
excess noise LlBil . 



In conclusion, we study the security of a continuous- 
variable quantum key distribution protocol with noisy coher- 
ent states sent through a lossy and noisy channel. Though the 
protocol discussed is a P&M scheme, it is proved to be equiv- 
alent to an E-B scheme when we assume the noise in coherent 
states is induced by Fred, a neutral party, who does not give 
Eve any information. Though the state shared by Alice, Bob 
and Eve is not a pure state, and the secure key rate can not be 
calculated directly, we can derive the maximal mutual infor- 
mation between Eve and Alice/ Bob, if she is able to acquire 
extra information from Fred. So, we actually derive a lower 
bound to the secure key rate. We also give a demonstration 
that when the channel is lossy but noiseless, the lower bound 
becomes lower than the key rate derived in ifisll with the in- 
crease of the excess noise in the coherent states. We can also 
purify the noisy coherent states to get a better estimation on 
the information lost. 
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